CVE-2026-71239

Received Received - Intake

Django Template Injection in DjangoCRM Massmail Module

Publication date: 2026-08-05

Last updated on: 2026-08-10

Assigner: TuranSec

Description

DjangoCRM's massmail module renders user-controlled EmlMessage fields (subject, content) through Django's Template constructor with no sanitization, in at least three locations: message_previews.py builds an f-string embedding message.subject/message.content directly into a Template call; email_creators.py passes eml_message.subject directly as a template string to Template; and helpers.py contains the same f-string interpolation pattern.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-05

Last Modified

2026-08-10

Generated

2026-08-18

AI Q&A

2026-08-05

EPSS Evaluated

2026-08-17

NVD

CVE-2026-71239

EUVD

EUVD-2026-53312

Affected Vendors & Products

Vendor	Product	Version / Range
django_crm	django_crm	From 6.0 (inc) to 3.12.0 (inc)
django	django	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1336	The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

Attack-Flow Graph

Executive Summary

This vulnerability in DjangoCRM's massmail module allows authenticated users with edit rights to inject Django template syntax into email subject and content fields. The flaw occurs because user-controlled input is rendered without sanitization through Django's Template() constructor in multiple locations like message_previews.py, email_creators.py, and helpers.py.

Detection Guidance

Check DjangoCRM's massmail module for user-controlled EmlMessage fields (subject, content) rendered via Django's Template() constructor without sanitization. Look for f-string embeddings in message_previews.py, email_creators.py, and helpers.py that pass message.subject/message.content directly to Template().

Impact Analysis

An attacker could exploit this to access other users' data and password hashes, forge CSRF tokens, or include arbitrary registered templates. This could lead to unauthorized data exposure, account compromise, or further attacks within the application.

Compliance Impact

This vulnerability likely violates GDPR's data protection principles by enabling unauthorized access to personal data and HIPAA's security requirements by exposing sensitive information like password hashes. It could result in non-compliance penalties and loss of trust.

Mitigation Strategies

Disable the massmail module if not in use. Apply input validation to EmlMessage fields to block Django template syntax ({{ }} / {% %}). Sanitize user-controlled data before passing to Template(). Update DjangoCRM to a patched version if available.

Hi! I’m here to help you understand CVE-2026-71239. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70